search

webcompat / web-bugs

A place to report bugs on websites.
https://webcompat.com
Mozilla Public License 2.0
737 stars 63 forks source link

fastweb.it - see bug description #1788

Closed webcompat-bot closed 5 years ago

webcompat-bot commented 8 years ago

URL: https://fastweb.it/myfastpage/accesso/ Browser / Version: Firefox 38.0 Operating System: Windows 7 Problem type: Something else - I'll add details below

Steps to Reproduce 1) Navigate to: https://fastweb.it/myfastpage/accesso/ 2) If you check server SSL you will find Vulnerability (https://www.ssllabs.com/ssltest/analyze.html?d=fastweb.it&latest) - ( https://www.ssllabs.com/ssltest/analyze.html?d=fastweb.it&s=62.101.76.205&latest )

3) Also in the top right there is Mail link who open a mail login page. This should be on SSL and is not in SSL. ( http://www.fastweb.it/servizi/fastmail/?header-portale=link-mail&from=home ) NO SSL PROTECTION.

Expected Behavior:

1 - 2) Server should be a B or A grade Secure no vulnerabilities

3) Mail should be under SSL

4) My Voice Home should be SSL protected (this is accessible only from customer panel )

Actual Behavior:

  1. If you scan the website (https://www.ssllabs.com/ssltest/analyze.html?d=fastweb.it&latest) - ( https://www.ssllabs.com/ssltest/analyze.html?d=fastweb.it&s=62.101.76.205&latest ) you can see server is PODDLE ATTACK vulnerable: This server is vulnerable to the POODLE attack against TLS servers. Patching required. Grade set to F.
  2. Server supports 512-bit export suites and might be vulnerable to the FREAK attack. Grade set to F

3) Also in the top right there is Mail link who open a mail login page. This should be on SSL and is not in SSL. ( http://www.fastweb.it/servizi/fastmail/?header-portale=link-mail&from=home ) NO SSL PROTECTION.

4) Also is necessary says to Fastweb also Voice Home services should be over SSL in the customers panel (this is not accessible to non customers)

karlcow commented 8 years ago

This is not a WebCompat issue (aka this is the same story on all browsers) but a security issue. Maybe a proper bug should be open elsewhere.

@miketaylr opinion?

miketaylr commented 8 years ago

Yeah, not a compat issue, but would benefit from some outreach. I think we should leave it open and set to needscontact.

karlcow commented 8 years ago

They interact on twitter. https://twitter.com/FASTWEBHelp/with_replies

karlcow commented 8 years ago

Contacted http://twitter.com/webcompat/status/685264249283674112

karlcow commented 8 years ago

Still the same issue.

Screenshot of the site issue

karlcow commented 8 years ago

Recontacted https://twitter.com/webcompat/status/722629035822415872

karlcow commented 8 years ago

Still not fixed.

reinhart1010 commented 6 years ago

Even worse the site still uses the Symantec certificate.

image

cipriansv commented 5 years ago

After retesting the issue I confirm that the issue has been fixed.

image

image

Tested with: Browser / Version: Firefox Nightly 70.0a1 (2019-08-21) Operating System: Windows 10 Pro